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The MAILING DATE of this communication appears on the cover sheet with the correspondence address— 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . ^ This communication is responsive to 8/31/04 . 

2. El The allowed claim(s) is/are 1-4.6.7.10-13.15.16 and 1 9-26 . 

3. O The drawings filed on are accepted by the Examiner. 

4. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a) □ All b)QSome* c) □ None of the: 

1. □ Certified copies of the priority documents have been received: 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

5. □ A SUBSTITUTE OATH OR DECLARATION must be submitted- Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 
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(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 
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(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 
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each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 
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EXAMINER'S AMENDMENT 

An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
Kevin J. Zilka, Reg. No. 41,429 on 12/14/2004. 
1 . Replace claims 1 , 1 0,20-24 with: 

1. A method for scanning data utilizing multiple scanning engines, comprising: 

(a) generating a request for data to be scanned for viruses utilizing a scanning interface; 

(b) sending the request to scan data to a plurality of scanning engines utilizing an engine 
interface application control module coupled between the scanning interface and the 
scanning engines, the request being adapted for prompting the scanning engines to scan 
the data and respond with events upon locating a virus; 

(c) receiving the events utilizing an event processor module coupled to the scanning 
engines and the engine interface application control module for processing the events; 
and 

(d) transmitting the processed events to the engine interface application control module 
for being monitored by the scanning interface; 

wherein the engine interface application control module translates the requests and events 
for each of the scanning engines; 
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wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor; 

wherein the requests and events for each of the scanning engines are in a format different 

from formats of the other scanning engines; 

wherein the scanning engines are incompatible scanning engines; 

wherein different proprietary scanning engines are combined into a single product. 

10. A computer program product for scanning data utilizing multiple scanning 
engines, comprising: 

(a) computer code for generating a request for data to be scanned for viruses utilizing a 
scanning interface; 

(b) computer code for sending the request to scan data to a plurality of scanning engines 
utilizing an engine interface application control module coupled between the scanning 
interface and the scanning engines, the request being adapted for prompting the scanning 
engines to scan the data and respond with events upon locating a virus, 

(c) computer code for receiving the events utilizing an event processor module coupled to 
the scanning engines and the engine interface application control module for processing 
the events; and 

(d) computer code for transmitting the processed events to the engine interface 
application control module for being monitored by the scanning interface; 

wherein the engine interface application control module translates the requests and events 
for each of the scanning engines; 
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wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor; 

wherein the requests and events for each of the scanning engines are in a format different 

from formats of the other scanning engines; 

wherein the scanning engines are incompatible scanning engines; 

wherein different proprietary scanning engines are combined into a single product. 

20. A system for scanning data utilizing multiple scanning engines, comprising: 

(a) a scanning interface for generating a request for data to be scanned for viruses; 

(b) an engine interface application control module coupled between the scanning 
interface and a plurality of scanning engines for sending the request to scan data to the 
scanning engines, the request being adapted for prompting the scanning engines to scan 
the data and respond with events upon locating a virus; and 

(c) an event processor module coupled to the scanning engines and the engine interface 
application control module for receiving the events and processing the events; 
wherein the processed events are outputted by the scanning interface; 

wherein the engine interface application control module translates the requests and events 
for each of the scanning engines; 

wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor; 

wherein the requests and events for each of the scanning engines are in a format different 
from formats of the other scanning engines; 
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wherein the scanning engines are incompatible scanning engines; 

wherein different proprietary scanning engines are combined into a single product. 

21. A method for scanning data utilizing multiple scanning engines, comprising: 

(a) means for generating a request for data to be scanned for viruses; 

(b) means for sending the request to scan data to the scanning engines, the requests being 
adapted for prompting the scanning engines to scan the data and respond with events 
upon locating a virus; and 

(c) means for receiving the events and processing the events; 

wherein the engine interface application control module translates the requests and events 
for each of the scanning engines; 

wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor; 

wherein the requests and events for each of the scanning engines are in a format different 

from formats of the other scanning engines; 

wherein the scanning engines are incompatible scanning engines; 

wherein different proprietary scanning engines are combined into a single product. 

22. A method for scanning data utilizing multiple scanning engines, comprising: 

(a) receiving data at a gateway; 

(b) generating a request for the data to be scanned for viruses in response to the receipt of 
data at the gateway utilizing a scanning interface; 
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(c) translating the request utilizing an engine interface application control module 
coupled between the scanning interface and a plurality of scanning engines; 

(d) sending the translated request to the scanning engines utilizing the engine interface 
application control module, the request being adapted for prompting the scanning engines 
to scan the data and respond with events upon locating a virus; 

(e) receiving the events utilizing an event processor module coupled to the scanning 
engines and the engine interface application control module; 

(f) checking an integrity of the events received utilizing the event processor module; 

(g) translating the events into a common format utilizing the event processor module if 
the events pass the integrity check engines; and 

(i) outputting the translated events utilizing the scanning interface; 

wherein the engine interface application control module translates the requests and events 

for each of the scanning engines; 

wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor; 

wherein the requests and events for each of the scanning engines are in a format different 

from formats of the other scanning engines; 

wherein the scanning engines are incompatible scanning engines; 

wherein different proprietary scanning engines are combined into a single product. 
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23. A method for scanning data utilizing a system capable of interfacing multiple 
scanning engines, comprising: identifying a request from a user for data to be scanned for 
viruses utilizing an interface; 

translating the request to be utilized by at least one of a plurality of different scanning 
engines; 

sending the translated request to the at least one of the scanning engines, the request 
being adapted for prompting the at least one scanning engine to scan the data and respond 
with events upon locating a virus; 

receiving the events from the at least one scanning engine; 
translating the events into a common format; 
outputting the translated events utilizing the interface; 

wherein the interface translates the requests and events for each of the scanning engines; 
wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor; 

wherein the requests and events for each of the scanning engines are in a format different 

from formats of the other scanning engines; 

wherein the scanning engines are incompatible scanning engines; 

wherein different proprietary scanning engines are combined into a single product. 

24. A computer program product for scanning data utilizing a system capable of 
interfacing multiple scanning engines, comprising: 
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computer code for identifying a request from a user for data to be scanned for viruses 
utilizing an interface; 

computer code for translating the request to be utilized by at least one of a plurality of 
different scanning engines; 

computer code for sending the translated request to the at least one of the scanning 
engines, the request being adapted for prompting the at least one scanning engine to scan 
the data and respond with events upon locating a virus; 
computer code for receiving the events from the at least one scanning engine; 
computer code for translating the events into a common format; and computer code for 
outputting the translated events utilizing the interface; 

wherein the interface translates the requests and events for each of the scanning engines; 
wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor; 

wherein the requests and events for each of the scanning engines are in a format, different 

from formats of the other scanning engines; 

wherein the scanning engines are incompatible scanning engines; 

wherein different proprietary scanning engines are combined into a single product. 

2. Cancel claims 9,18,27. 

Examiner's Statement of Reasons for Allowance 

3. Claims 1-4,6,7,10-13,15,16 and 19-26 are allowed over prior art. 
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4. This action is in reply to applicant's correspondence of 3 1 August 2004. 

5. The following is an examiner's statement of reasons for the indication of allowable 
claimed subject matter. 

6. As per claims 1,11,15, prior art of record, Hill et al, U.S. Patent 6,088,804 fails to teach, 
alone, or in combination, of (as shown for claim 1 by example); 

(claim 1) A method for scanning data utilizing multiple scanning engines, comprising: 

(a) generating a request for data to be scanned for viruses utilizing a scanning interface; 

(b) sending the request to scan data to a plurality of scanning engines utilizing an engine 
interface application control module coupled between the scanning interface and the 
scanning engines, the request being adapted for prompting the scanning engines to scan 
the data and respond with events upon locating a virus; 

(c) receiving the events utilizing an event processor module coupled to the scanning 
engines and the engine interface application control module for processing the events; 
and 

(d) transmitting the processed events to the engine interface application control module 
for being monitored by the scanning interface; 

wherein the engine interface application control module translates the requests and 
events for each of the scanning engines, 

wherein the scanning engines are unique proprietary scanning engines each associated 
with a different vendor, 

wherein the requests and events for each of the scanning engines are in a format different 
from formats of the other scanning engines, 
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wherein the scanning engines are incompatible scanning engines, 

wherein different proprietary scanning engines are combined into a single product. 

7. The italicized above claim elements dealing with (for example; claim 1) A method for 
scanning data utilizing multiple scanning engines, comprising: " ... sending the request to scan 
data to a plurality of scanning engines . . . receiving the events utilizing an event processor 
module coupled to the scanning engines and the engine interface . . . translates the requests and 
events for each of the scanning engines, . . . scanning engines are unique proprietary scanning 
engines each associated with a different vendor, . . . requests and events for each of the scanning 
engines are in a format different from formats of the other scanning engines, . . . scanning 
engines are incompatible scanning engines, . . . different proprietary scanning engines are 
combined into a single product. . ." serving to patently distinguish the invention from prior art. 
Specifically, the use of multiple scanning engines (or agents, remote objects, etc.) executing on 
same or multiple servers in a network or inter-network (i.e., the Internet), per se, is known in the 
prior art. 

However, as per the applicants arguments in the previous remarks in the Amendment 
(August 31, 2004), the examiner finds the applicant's arguments to be persuasive in that, the 
utilization of a common interface to request scanning services, and process said request returned 
results when the scanning engines data (i.e., storage/communications) protocols are, collectively, 
explicitly formatted differently, from different vendors, incompatible in the broader sense 
beyond just the specific formatting differences, and the engines, again collectively, are combined 
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into a single product, is patently unique. These aspects serving to patently distinguish the 
invention from the prior art of record. 

Further, the use of hardware based multiple scanners (i.e., see Lockwood, J.,et al, "Internet 

Worm and Virus Protection in Dynamically Reconfigurable Hardware", Washington University, Applied Reasearch 
Lab., 9/9/2003, " http://www.arl. wustl.edu/Hockwood/pub I ications/MAPLD_2003_e1 0_lockwood_p.pdf, entire 
document), or more conventional software based IDS's (i.e., see Network Associates, inc., "Next 
Generation Intrusion Detection in High-Speed Networks", Network Associates, Inc., 1999, 

"http://www.cc.gatech.edu/classes/AY2004/c^6255JalUpapers/6_ACTJDS_001.pcH ,, , entire document), clearly do 
not address the applicant's inventive aspect insofar as the said references deal with generally 
performance aspects of the specific architectures (i.e., "quantitative aspect") versus the idea of an 
IDS "robustness" quality (i.e., "qualitative aspect"). 

However, the claim language (at least insofar as independent claims 1,10,20-24 are 
concerned) clearly and explicitly relates the collective incompatibility of the scanning engines 
used in an integrated combination to form a product (embodiment) that is the central idea that the 
invention is concerned with. 

8. Claims 10,20,21 deal with software, system, and means plus function embodiment 
variations for the method of claim 1 . Claim 22 deals with the gateway network level system 
oriented embodiment method aspect of the method of claim 1. Claims 23,24 deal with method 
and software variations for the method of claim 1 focusing on the point of reception of the 
request (i.e., similar to the gateway aspect of claim 22). These claims clearly encompass the 
inventive aspects of the claim 1 limitations across various claim 1 alternative embodiments, and 
are allowable on a similar basis. 
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9. Dependent claims 2-5,7-10,12-13,16-17 are allowable by virtue of their dependencies. 



10. Any inquiry concerning this communication or earlier communications from examiner 
should be directed to Ronald Baum, whose telephone number is (571) 272-3681, and whose 
unofficial Fax number is (571) 273-3681. The examiner can normally be reached Monday 
through Friday from 8:00 AM to 5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh, can be reached at (571) 272-3795. The Fax number for the organization 
where this application is assigned is 703-872-9306. 

Ronald Baum 



Conclusion 



Patent Examiner 
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